Catalog collect: per-IP budget and fill-only writes; bulk import moves to an admin/API-token route

server/server.js

@@ -366,7 +366,8 @@ const requestMonitor = createRequestMonitor({
   },
 });
 if (process.env.OPS_MONITOR !== '0') app.use('*', requestMonitor.middleware());
-registerCatalogRoutes(app, { resolveListener: recommendationListener });
+registerCatalogRoutes(app, { resolveListener: recommendationListener,
+  adminAuth: (c, next) => notes.requireAdminOrToken(c, next) });  // notes is registered further down
 
 // ============================================================================
 // API routes